Credential スキーマ

​

Vault credential object

作成、更新、取得、一覧、およびアーカイブの各エンドポイントはこの構造を返します。token、access_token、refresh_token、client_secret、secret_value などの Credential のシークレットは作成または更新リクエストでのみ受け付けられ、レスポンスには返されません。

​

Identity の帰属

アカウント（または Workspace）には複数の Identity を作成できます。各 Identity は、そのアカウント（または Workspace）と連携する製品のエンドユーザーを表します。 A Credential does not store ownership separately. It inherits ownership entirely from its Vault:

• Before accessing a Credential, the service checks its Vault against the current ownership scope. In a valid Identity scope, a Vault owned by another Identity returns 404. PAT calls without identity_id and Admin SAT calls retain the existing Owner mismatch 403. If this check fails, Credential processing does not continue.
• Every Credential in an Identity-owned Vault is visible only to that Identity.
• Create, list, get, update, archive, and delete Credential endpoints support the identity_id query parameter with the same semantics as Vaults. See Vault identity ownership.

identity_id is optional and is used only for Identity-owned resources. A PAT can specify it explicitly; omitting it uses the administrator scope. With SAT, issue an Identity-scoped token and do not explicitly pass this parameter; otherwise, the request returns HTTP 400.

​

Create credential request

​

Credential 更新リクエスト

auth と metadata のみを受け付け、少なくとも 1 つのフィールドが必要です。その他のフィールドを指定すると 400 invalid_request_error が返されます。 完全なフィールド制約については、Credential の更新を参照してください。

​

Credential auth object

auth uses type to select the authentication type. Responses never include secret fields.

​

static_bearer

​

mcp_oauth

​

environment_variable

The create endpoint for the Forward Credential API defines the supported authentication types. Unlisted types return 400 invalid_request_error during creation.

​

List pagination fields

The request cursor parameters page, after_id, and before_id are mutually exclusive; providing more than one returns 400. Use page where possible; it has the same semantics as after_id.